OT Cybersecurity: A Guide for Plant Engineers

The Big Lie: "My Plant Is Air-Gapped" #

99% of plant engineers believe their PLCs are safe because "they have no internet." Wrong. If there is a contractor with a USB stick, a support engineer with TeamViewer or an open maintenance port, your plant is exposed.

2025 was a record year for industrial ransomware. The goal? Not to steal data, but to stop production and extort management.

IT vs OT: Opposite Priorities #

The IT team doesn't understand your world. They patch servers on Sundays at 3 AM. If you patch a SCADA system while it is running, you could cause a fatal accident.

The Purdue Model: Defense in Depth #

There is no such thing as "antivirus software for PLCs." The only real defense is network segmentation based on the Purdue Model (ISA-95).

Levels 0-2 (Critical OT)

This is where your PLCs, HMIs and sensors live. GOLDEN RULE: no device on this network should have a direct path to the internet. EVER.

Level 3 (Industrial DMZ)

The demilitarized zone. This is where you place a "mirror" server (historian, patch server). The PLCs talk to the DMZ. The IT network talks to the DMZ. But IT never talks directly to the PLC.

3 Immediate Actions (No Cost) #

• Disable unused ports: close ports 80 (HTTP) and 23 (Telnet) on your PLCs. Use only 443 (HTTPS) and 22 (SSH).
• Change default passwords: "admin/admin", "1234", "service". Attackers have dictionaries with the default credentials for Siemens, Rockwell and Omron.
• Offline backups: ransomware also encrypts backups connected to the network. Keep a copy on a physically disconnected hard drive.